Betheme

betheme

Vulnerabilities:

19

Last Updated:

September 4, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2026-08-25
Title
Betheme < 28.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
Fixed in
Fixed in 28.4.1
CVSS
5.5 (medium)
Published
2026-07-28
Title
Betheme <= 28.5.7 - Authenticated (Contributor+) Remote Code Execution
Fixed in
Fixed in 28.5.8
CVSS
7.2 (high)
Published
2026-05-04
Title
Betheme < 28.4.1 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload
Fixed in
Fixed in 28.4.1
CVSS
7.2 (high)
Published
2026-05-04
Title
Betheme < 28.4.1 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'
Fixed in
Fixed in 28.4.1
CVSS
4.9 (medium)
Published
2025-10-08
Title
Betheme < 28.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'
Fixed in
Fixed in 28.1.7
CVSS
6.4 (medium)
Published
2025-10-06
Title
Betheme < 28.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 28.2.1
CVSS
6.4 (medium)
Published
2025-08-05
Title
Betheme < 28.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 28.1.4
CVSS
6.4 (medium)
Published
2025-04-15
Title
Betheme < 28.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 28.0.4
CVSS
6.4 (medium)
Published
2025-01-20
Title
Betheme < 27.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
Fixed in
Fixed in 27.6.2
CVSS
6.4 (medium)
Published
2024-09-12
Title
Betheme | Responsive Multipurpose WordPress & WooCommerce Theme < 27.5.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File
Fixed in
Fixed in 27.5.6
CVSS
6.4 (medium)
Published
2024-08-29
Title
Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
No known fix
CVSS
6.4 (medium)
Published
2024-08-29
Title
Betheme < 27.5.7 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 27.5.7
CVSS
8.8 (high)
Published
2023-11-14
Title
Betheme < 27.1.2 - Missing Authorization
Fixed in
Fixed in 27.1.2
CVSS
6.3 (medium)
Published
2023-04-13
Title
Betheme < 26.8 - Reflected XSS
Fixed in
Fixed in 26.8
CVSS
7.1 (high)
Published
2022-11-22
Title
BeTheme < 26.6.3 - Subscriber+ Stored XSS
Fixed in
Fixed in 26.6.3
CVSS
5.4 (medium)
Published
2022-11-21
Title
Betheme < 26.6.3 - Subscriber+ Unauthorised Action
Fixed in
Fixed in 26.6.3
CVSS
4.3 (medium)
Published
2022-11-21
Title
Betheme < 26.6.3 - Missing Authorization
Fixed in
Fixed in 26.6.3
CVSS
8.1 (high)
Published
2022-11-21
Title
Betheme < 26.6 - Contributor+ PHP Object Injection
Fixed in
Fixed in 26.6
CVSS
5.0 (medium)
Published
2022-11-17
Title
Betheme < 26.6 - Subscriber+ PHP Object Injection
Fixed in
Fixed in 26.6
CVSS
5.0 (medium)